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DETAILED ACTION 

1 . The amendment of 13 October 2005 has been noted and made of record. 

2. Claims 1 -39 have been presented for examination. 

Response to Arguments 
3 Applicant's arguments filed 13 October 2005 have been fully considered but they are not 
persuasive. 

4. In response to applicant's arguments against the references individually, one cannot show 
nonobviousness by attacking references individually where the rejections are based on 
combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re 
Merck & Ca, 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). 

5. As cited in the previous office action, both Chess and Smithson disclose techniques for 
keeping track of files. The previous action also cites the abstract of Smithson as also providing a 
teaching of the tracking for a number of times a file is sent for review. It appears that Chess 
gives a more in depth discussion of tracking a file as well as keeping a value of one or more 
predetermined attributes relating to the file, such as whether the file is safe or questionable as 
discussed in column 5, lines 5-48. 

6. Therefore, the combination of references disclose a count value indicating a number of 
times that the file has been sent to the computer for review and a value of one or more 
predetermined attributes relating to the file. 

7. In response to the Applicant's argument that the combination of references does not 
disclose referencing a weighting table to determine the weighting to be associated with the file, 
based on the value of said one or more predetermined attributes associated with that file in the 
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statistical log, the Examiner disagrees. The Applicant is merely arguing the references 
individually and not in combination. As discussed above, Chess discloses a technique for 
determining the likelihood of a file being infected by the addition or change of code since the last 
time the file has been reviewed in at least column 5, lines 5-48, in determining whether the file is 
safe or questionable. 

8. Therefore, the combination of references disclose referencing a weighting table to 
determine the weighting to be associated with the file, based on the value of said one or more 
predetermined attributes associated with that file in the statistical log. 

9. See further rejections that follow. 

Claim Rejections - 35 USC § 101 
35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 
any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

10. As per claims 1-13, merely claimed as a computer program product representing a 
computer listing per se, that is, descriptions or expressions of such a program and that is, 
descriptive material per se, non-functional descriptive material, and is not statutory because it is 
not a physical "thing" nor a statutory process, as there are not "acts" being performed. Such 
claimed computer programs do not define any structural and functional interrelationships 
between the computer program product and other claimed aspects of the invention which permit 
the computer program's functionality to be realized. Since a computer program is merely a set 
of instructions capable of being executed by a computer, the program itself is not a process, 
without. the computer-readable medium needed to realize the computer program's functionality. 
In contrast, a claimed computer-readable medium encoded with a computer program defines 
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structural and functional interrelationships between the computer program and the medium 
which permit the computer program's functionality to be realized, and is thus statutory. 
Warmerdam, 33 F.3d at 1361, 31 USPQ2d at 1760. In re Sarkar, 588 F.2d 1330, 1333, 200 
USPQ 132, 137 (CCPA 1978). See MPEP § 2106(IV)(B)(l)(a). 

Claim Rejections 

11. The text of those sections of Title 35, U.S. Code not included in this action can be found 
in a prior Office action. 

12. Claims 1-2, 7-12, 14-15, 20-25, 27-28 and 33-38 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over U.S. Patent No. 6,71 1,583 to Chess et al., hereinafter Chess, in view of 
U.S. Patent No. 6,886,099 to Smithson et al., hereinafter Smithson. 

13. As per claims 1,14 and 27, Chess discloses a computer program product for operating a 
computer to review files for potential malware (column 4, lines 4-10), comprising: 

logging code operable to maintain a statistical log having an entry for each file sent to the 
computer for review, each entry being arranged to store a count value indicating the number of 
times that the file has been sent to the computer for review and a value of one or more 
predetermined attributes relating to the file (column 4, hne 62 through column 5, line 5, i.e. 
maintaining in the database the Nth occurrence of the document being scanned); 

statistical log interface code operable, upon receipt of a file, to determine with reference 
to the statistical log the count value relating to that file (column 2, lines 44-54, column 5, lines 
11-16); 

action determination code operable, if the count value determined by the statistical log 
interface code exceeds a predetermined threshold (column 6, lines 1 5-28). 
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14. Chess does not disclose a weighting table identifying, for each value of the predetermined 
attributes, a weighting indicating the likelihood that a file having that value of predetermined 
attributes will be malware and to reference the weighting table to determine the weighting to be 
associated with the file in case the count value exceeds the threshold and take actions based on 
that weight. 

15. Smithson discloses a method for computer virus detection where he discloses a method 
for detecting computer viruses based on some predetermined criteria such as the count of the file 
(See Abstract) where he teaches using a weighting table identifying, for each value of 
predetermined attributes (column 4, lines 50- 62, column 9, lines 21-27), a weighting indicating 
the likelihood that a file having that value of said one or more predetermined attributes will be 
malware (column 4, lines 5-20), based on the value of said one or more predetermined attributes 
associated with that file in the statistical log (column 4, lines 25-40, column 6, lines 35-43), and 
performing a predetermined actions dependent on the weighting determined by determination 
code (column 6, Unes 34-44 and column 8, lines 13-31). 

16. It would have been obvious to one ordinary skilled in the art at the time the invention was 
made to modify Chess system with the teachings of Smithson to base actions based on a 
weighting tables for the files. One would be motivated to do so in order to enable the system to 
detect unknown viruses, because using such technique is not looking for an individual virus or 
pattern of execution of a virus, it is able to more readily detect previously unknown viruses by 
the effect that they have on the activity of the computer system as a whole (Smithson: column 2, 
lines 10-15). 
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17. Regarding claims 2, 15 and 28, Chess wherein said one or more predetermined attributes 
comprise an indication of the file type of the file (column 4, lines 24-34). 

18. Regarding claims 7, 20 and 33, Chess discloses wherein if the weighting indicates that 
the file is to be treated with caution, said action performing code is operable to perform the steps 
of: 

(i) associating a warning message with the file for reference by a person receiving that 
file (column 5, lines 39-46, i.e. "questionable" status), and 

(ii) generating for access by an administrator a notification identifying the file (column 6, 
lines 54-65). 

19. Regarding claims 8, 21 and 34, Smithson teaches if the weighting indicates that the file is 
safe, said action performing code is operable to generate for access by an administrator a 
notification identifying the file (column 8, lines 54-60 i.e. notification will be sent to 
administrator). 

20. Regarding claims 9, 22 and 35, Chess discloses wherein if it is determined that a file sent 
to the computer is not currently entered in the statistical log (Figure 3 A [block 301]), the logging 
code is further operable to create an entry in the statistical log for the file (column 5, lines 11-20), 
in which the value of said one or more predetermined attributes relating to the file are stored, and 
in which the count value is initialized (column 5, lines 1-5, column 5, lines 20-29). 
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21. Regarding claims 10, 23 and 36, Chess discloses wherein upon receipt of a file, the 
statistical log interface code is operable to cause the count value within the relevant entry of the 
statistical log to be incremented to account for the current occurrence of the file (column 2, lines 
44-51, column 4, line 62 through column 5, line 5). 

22. Regarding claims 1 1, 24 and 37, Smithson discloses reviewing files included in e-mail 
communications (column 3, lines 26-33), and each entry in the statistical log is further arranged 
to identify, for each sender of that file, the number of times that that sender has sent the file in 
addition to the count value indicating the total number of times that the file has been sent 
(column 4, lines 25-40). 

23. Regarding claims 12, 25 and 38, Chess discloses discloses upon receipt of a file, the 
statistical log interface code is operable to cause the count value within the relevant entry of the 
statistical log to be incremented to account for the current occurrence of the file (column 3, lines 
17-23), and the number by which the count value is incremented is dependent on the number of 
times that the sender of the current occurrence of the file has previously sent that file (column 5, 
lines 1 1-28). 

24. Claims 3-6, 13, 16-19, 26, 29-32 and 39 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Chess in view of Smithson as applied above, and further in view of U.S. 
Patent No. 6,401,210 to Templeton, hereinafter Templeton. 
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25. Regarding claims 3, 16 and 29, Chess discloses if the weighting indicates that the file is 
probably malware, said action performing code is operable to perform the steps of: 

notifying the user of the file (column 6, lines 51-62). 

26. The combination of Chess and Smithson does not disclose encrypting the file such that 
only an administrator can decrypt that file. 

27. Templeton discloses a method for managing virus-infected files (See Abstract) where he 
teaches detecting a virus in a file encrypting the file in such a way that only the administrator 
(system operator) can decrypt that file (column 3, lines 23-27, column 4, line 64 through column 
5, line 5). 

28. It would have been obvious to one ordinary skilled in the art at the time the invention was 
made to combine the teachings of Chess and Smithson with the teachings of Templeton to 
encrypt the file after detecting a virus present in the file in was that only the administrator can 
decrypt the file. One would be motivated to do so in order enable the system to safely store files 
that have a high probability of being infected and prevent the user from opening the files and 
spreading the virus to another files or computers while being able to reproduce the original file 
for further analysis or cleaning at later time (column 1, lines 44-54). 

29. Regarding claims 4, 17 and 30, Templeton discloses associating a message with the file 
for reference by a person receiving that file, the message identifying that the file has been 
encrypted (column 3, lines 61-64, column 4, lines 29-40). 
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30. Regarding claims 5, 18 and 3 1, Chess teaches notifying the user of the file (column 6, 
lines 51-62). 

3 1 . The combination of Chess and Smithson does not disclose encrypting the file such that 
only an administrator and the originator of the file can decrypt that file. 

32. Templeton discloses a method for managing virus-infected files (See Abstract) where he 
teaches upon detecting a virus in a file encrypting the file (column 4, line 64 through column 5, 
line 5) in such a way that only the system operator or the owner can decrypt that file 
(column 3, lines 23-27, column 3, lines 50-55). 

33. It would have been obvious to one ordinary skilled in the art at the time the invention was 
made to combine the teachings of Chess and Smithson with the teachings of Templeton to 
encrypt the file after detecting a virus present in the file in was that only the administrator or the 
owner can decrypt the file. One would be motivated to do so in order enable the system to safely 
store files that have a high probability of being infected and prevent the recipients from opening 
the files and spreading the virus to another files or computers while being able to reproduce the 
original file for fiirther analysis or cleaning at later time (column 1, lines 44-54). 

34. Regarding claims 6, 19 and 32, Templeton discloses wherein the action performing code 
is further operable to associate a message with the file for reference by a person receiving that 
file, the message identifying that the file has been encrypted (column 3, lines 61-64, column 4, 
lines 29-40). 
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35. Regarding claims 13, 26 and 39, Smithson discloses wherein if said action performing 
code is arranged, dependent on the weighting (column 5, line 65 through column 6, line 3), to 
quarantine the file or delete it, 

36. The combination of Chess and Smithson does not disclose encrypting the file and an 
automated decryption code operable, if the file is subsequently determined to be safe, to perform 
the steps of locating all encrypted occurrences of that file on a file system, and decrypting each 
said occurrence. 

37. Templeton discloses a method for managing virus infected files (See Abstract) where he 
teaches after determining that a file has been infected (column 4, lines 44-45), encrypting that 
file for later time (column 4, lines 64-67) and when a determination is made that the file is safe to 
locate the file and decrypt each occurrence of that file (column 5, lines 16-31). 

38. It would have been obvious to one ordinary skilled in the art at the time the invention was 
made to modify the system to include locating and decrypting files that have been determined to 
be safe. One would be motivated to do so to enable the user to view and use files that have been 
analyzed and determined to be free from viruses. 

Conclusion 

39. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

40. A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
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will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

41 . Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Christian La Forgia whose telephone number is (571) 272-3792. 
The examiner can normally be reached on Monday thru Thursday 7-5. 

42. If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

43. Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
appUcations is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 



Christian LaForgia 
Patent Examiner 
Art Unit 2131 
clf 




